<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.taskmods.DllList : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.t.DllList(<a href="volatility.plugins.common.AbstractWindowsCommand.html">common.AbstractWindowsCommand</a>, <a href="volatility.cache.Testable.html">cache.Testable</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.taskmods.html">taskmods</a></span>
      
      <a href="classIndex.html#volatility.plugins.taskmods.DllList">View In Hierarchy</a>
    </p>
    <div>
      <p>Known subclasses: <a href="volatility.plugins.envars.Envars.html">volatility.plugins.envars.Envars</a>, <a href="volatility.plugins.getsids.GetSIDs.html">volatility.plugins.getsids.GetSIDs</a>, <a href="volatility.plugins.handles.Handles.html">volatility.plugins.handles.Handles</a>, <a href="volatility.plugins.malware.malfind.LdrModules.html">volatility.plugins.malware.malfind.LdrModules</a>, <a href="volatility.plugins.malware.malfind.YaraScan.html">volatility.plugins.malware.malfind.YaraScan</a>, <a href="volatility.plugins.malware.threads.Threads.html">volatility.plugins.malware.threads.Threads</a>, <a href="volatility.plugins.procdump.ProcExeDump.html">volatility.plugins.procdump.ProcExeDump</a>, <a href="volatility.plugins.strings.Strings.html">volatility.plugins.strings.Strings</a>, <a href="volatility.plugins.taskmods.MemMap.html">volatility.plugins.taskmods.MemMap</a>, <a href="volatility.plugins.taskmods.PSList.html">volatility.plugins.taskmods.PSList</a>, <a href="volatility.plugins.vadinfo.VADInfo.html">volatility.plugins.vadinfo.VADInfo</a></p>
    </div>
    <div>Print list of loaded dlls for each process<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id1348">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#__init__">__init__</a></td>
    <td><span>Constructor uses args as an initializer. It creates an instance of OptionParser, populates the options, and finally parses the command line. Options are stored in the self.opts attribute.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#render_text">render_text</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#filter_tasks">filter_tasks</a></td>
    <td><span>Reduce the tasks based on the user selectable PIDS parameter.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#virtual_process_from_physical_offset">virtual_process_from_physical_offset</a></td>
    <td><span>Returns a virtual process from a physical offset in memory</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#calculate">calculate</a></td>
    <td><span>Produces a list of processes, or just a single process based on an OFFSET</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>:
        </p>
        <table class="children sortable" id="id1349">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.common.AbstractWindowsCommand.html#is_valid_profile">is_valid_profile</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.commands.Command.html">Command</a> (via <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>):
        </p>
        <table class="children sortable" id="id1350">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.commands.Command.html#register_options">register_options</a></td>
    <td><span>Registers options into a config object provided</span></td>
  </tr><tr class="baseclassmethod">
    
    
    <td>Class Method</td>
    <td><a href="volatility.commands.Command.html#help">help</a></td>
    <td><span>This function returns a string that will be displayed when a user lists available plugins.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#execute">execute</a></td>
    <td><span>Executes the plugin command.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#format_value">format_value</a></td>
    <td><span>Formats an individual field using the table formatting codes</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_header">table_header</a></td>
    <td><span>Table header renders the title row of a table</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_row">table_row</a></td>
    <td><span>Outputs a single row of a table</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_formatlookup">_formatlookup</a></td>
    <td><span>Code to turn profile specific values into format specifications</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_elide">_elide</a></td>
    <td><span>Adds three dots in the middle of a string if it is longer than length</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.cache.Testable.html">Testable</a>:
        </p>
        <table class="children sortable" id="id1351">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.cache.Testable.html#test">test</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.cache.Testable.html#_flatten">_flatten</a></td>
    <td><span>Flattens an item, including all generators</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.taskmods.DllList.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, config, *args, **kwargs):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#__init__">volatility.commands.Command.__init__</a></div><div class="interfaceinfo">overridden in <a href="volatility.plugins.handles.Handles.html">volatility.plugins.handles.Handles</a>, <a href="volatility.plugins.malware.malfind.YaraScan.html">volatility.plugins.malware.malfind.YaraScan</a>, <a href="volatility.plugins.malware.threads.Threads.html">volatility.plugins.malware.threads.Threads</a>, <a href="volatility.plugins.procdump.ProcExeDump.html">volatility.plugins.procdump.ProcExeDump</a>, <a href="volatility.plugins.strings.Strings.html">volatility.plugins.strings.Strings</a>, <a href="volatility.plugins.taskmods.MemDump.html">volatility.plugins.taskmods.MemDump</a>, <a href="volatility.plugins.taskmods.PSList.html">volatility.plugins.taskmods.PSList</a>, <a href="volatility.plugins.vadinfo.VADDump.html">volatility.plugins.vadinfo.VADDump</a></div>
    <div>Constructor uses args as an initializer. It creates an instance
of OptionParser, populates the options, and finally parses the
command line. Options are stored in the self.opts attribute.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.taskmods.DllList.render_text">
    
  </a>
  <a name="render_text">
    
  </a>
  <div class="functionHeader">
    
    def
    render_text(self, outfd, data):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overridden in <a href="volatility.plugins.envars.Envars.html">volatility.plugins.envars.Envars</a>, <a href="volatility.plugins.getsids.GetSIDs.html">volatility.plugins.getsids.GetSIDs</a>, <a href="volatility.plugins.handles.Handles.html">volatility.plugins.handles.Handles</a>, <a href="volatility.plugins.malware.malfind.LdrModules.html">volatility.plugins.malware.malfind.LdrModules</a>, <a href="volatility.plugins.malware.malfind.YaraScan.html">volatility.plugins.malware.malfind.YaraScan</a>, <a href="volatility.plugins.malware.threads.Threads.html">volatility.plugins.malware.threads.Threads</a>, <a href="volatility.plugins.procdump.ProcExeDump.html">volatility.plugins.procdump.ProcExeDump</a>, <a href="volatility.plugins.strings.Strings.html">volatility.plugins.strings.Strings</a>, <a href="volatility.plugins.taskmods.MemMap.html">volatility.plugins.taskmods.MemMap</a>, <a href="volatility.plugins.taskmods.PSList.html">volatility.plugins.taskmods.PSList</a>, <a href="volatility.plugins.vadinfo.VADInfo.html">volatility.plugins.vadinfo.VADInfo</a></div>
    <div class="undocumented">Undocumented</div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.taskmods.DllList.filter_tasks">
    
  </a>
  <a name="filter_tasks">
    
  </a>
  <div class="functionHeader">
    
    def
    filter_tasks(self, tasks):
    
  </div>
  <div class="functionBody">
    
    <div>Reduce the tasks based on the user selectable PIDS parameter.</p>
<p>Returns a reduced list or the full list if config.PIDS not specified.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.taskmods.DllList.virtual_process_from_physical_offset">
    
  </a>
  <a name="virtual_process_from_physical_offset">
    
  </a>
  <div class="functionHeader">
    
    def
    virtual_process_from_physical_offset(self, addr_space, offset):
    
  </div>
  <div class="functionBody">
    
    <div>Returns a virtual process from a physical offset in memory<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.taskmods.DllList.calculate">
    
  </a>
  <a name="calculate">
    
  </a>
  <div class="functionHeader">
    @cache.CacheDecorator('tests/pslist/pid={0}/offset={1}'.format(self._config.PID, self._config.OFFSET))<br />
    def
    calculate(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#calculate">volatility.commands.Command.calculate</a></div><div class="interfaceinfo">overridden in <a href="volatility.plugins.dlldump.DLLDump.html">volatility.plugins.dlldump.DLLDump</a>, <a href="volatility.plugins.handles.Handles.html">volatility.plugins.handles.Handles</a>, <a href="volatility.plugins.malware.apihooks.ApiHooks.html">volatility.plugins.malware.apihooks.ApiHooks</a>, <a href="volatility.plugins.malware.malfind.YaraScan.html">volatility.plugins.malware.malfind.YaraScan</a>, <a href="volatility.plugins.malware.threads.Threads.html">volatility.plugins.malware.threads.Threads</a>, <a href="volatility.plugins.moddump.ModDump.html">volatility.plugins.moddump.ModDump</a>, <a href="volatility.plugins.strings.Strings.html">volatility.plugins.strings.Strings</a>, <a href="volatility.plugins.taskmods.MemMap.html">volatility.plugins.taskmods.MemMap</a></div>
    <div>Produces a list of processes, or just a single process based on an OFFSET<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>